Django admin - giving users access to specific objects/fields?

Question

I need to make an "owners" login for the admin. Say we have this model structure:

class Product(models.Model):
    owner = models.ManyToManyField(User)
    name = models.CharField(max_length=255)
    description = models.CharField(max_length=255)
    photos = models.ManyToManyField(Photo, through='ProductPhoto')


class Photo(models.Model):
    order = models.IntegerField()
    image = models.ImageField(upload_to='photos')
    alt = models.CharField(max_length=255)


class ProductPhoto(models.Model):
    photo = models.ForeignKey(Photo)
    product = models.ForeignKey(Product)

We have a group called Owners that some users are part of. The ProductPhoto is a TabularInline on the Product admin page.

Now, owners need permission to edit

(primary goal) only products where product__in=user.products (so basically, only products owned by them).
(secondary goal) only the description and photos of products

How would I do this with Django's admin/permission system?

Burhan Khalid · Accepted Answer · 2012-06-21 14:33:55Z

4

This is row (or object) level permission. Django provides basic support for object permissions but it is up to you to implement the code.

Luckily, there are a few apps that provide drop-in object-level permission framework. django-guardian is one that I have used before. This page on djangopackages.com provides some more that you can try out.

edited Jun 21, 2012 at 14:33

answered Jun 21, 2012 at 13:07

Burhan Khalid

175k20 gold badges255 silver badges292 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Andy Baker Over a year ago

Actually - this is a better djangopackages page: djangopackages.com/grids/g/perms

antihero Over a year ago

Ah, field level is what I need also now. Is there a way to implement this on top of guardian? Or does another framework provide this?

AndyC · Accepted Answer · 2022-06-28 13:37:12Z

0

You may implement using get_form. For complex rule, you can add this too: https://github.com/dfunckt/django-rules

  def get_form(self, request, obj=None, **kwargs):
    form = super().get_form(request, obj, **kwargs)        
    # permission check;         
    if form.base_fields and not request.user.is_superuser:
        # when creating or updating by non-reviewer (except superuser)
        # allow only reviewer to allow updating
        form.base_fields['usertype'].disabled = True

answered Jun 28, 2022 at 13:37

AndyC

1392 silver badges4 bronze badges

Collectives™ on Stack Overflow

Django admin - giving users access to specific objects/fields?

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related